Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%
Buy Us a Coffee

Bug Bounty Intelligence

Source: HackerOne public disclosures · updated every 6h

Browse publicly disclosed bug bounty reports from HackerOne. Filter by severity, weakness type, or program. Cross-referenced with CVE IDs where available.

Disclosed Reports
12,219
CVE-linked
1,854
Programs
342
New This Week
10
Severity: All CriticalHighMediumLow
Type: All Information Disclosure 1173 Cross-site Scripting (XSS) … 747 Violation of Secure Design … 719 Improper Access Control - Generic 656 Improper Authentication - Generic 652 Cross-site Scripting (XSS) … 513 Uncontrolled Resource Consumption 483 Cross-site Scripting (XSS) … 461 Cross-Site Request Forgery (CSRF) 421 Privilege Escalation 375
Program filter: curl✕
CVE-2022-27780: percent-encoded path separator in URL host
curl Server-Side Request Forgery (SSRF) (CWE-918)CVE-2022-27780
Medium
2022-05-11
CVE-2022-27782: TLS and SSH connection too eager reuse
curl Business Logic Errors (CWE-840)CVE-2022-27782
Medium
2022-05-11
CVE-2022-27779: cookie for trailing dot TLD
curl Information Exposure Through Sent Data (CWE-201)CVE-2022-27779
Medium
2022-05-11
CVE-2022-27778: curl removes wrong file on error
curl Business Logic Errors (CWE-840)CVE-2022-27778
Medium
2022-05-11
Certificate authentication re-use on redirect
curl Business Logic Errors (CWE-840)
Medium
2022-05-11
CVE-2022-22576: OAUTH2 bearer bypass in connection re-use
curl Improper Authentication - Generic (CWE-287)CVE-2022-22576
Medium
2022-04-29
CVE-2022-27776: Auth/cookie leak on redirect
curl Insufficiently Protected Credentials (CWE-522)CVE-2022-27776
Medium
2022-04-27
CVE-2022-27775: Bad local IPv6 connection reuse
curl Business Logic Errors (CWE-840)CVE-2022-27775
Low
2022-04-27
CVE-2022-27774: Credential leak on redirect
curl Insufficiently Protected Credentials (CWE-522)CVE-2022-27774
High
2022-04-27
CURLOPT_SSH_HOST_PUBLIC_KEY_SHA256 comparison disaster
curl Cryptographic Issues - Generic (CWE-310)
Medium
2022-04-25
CURLOPT_SSH_HOST_PUBLIC_KEY_MD5 bypass if string not 32 chars
curl Business Logic Errors (CWE-840)
Medium
2022-04-25
--libcurl code injection via trigraphs
curl Code Injection (CWE-94)
Low
2022-04-24
curl proceeds with unsafe connections when -K file can't be read
curl Improper Check or Handling of Exceptional Conditions (CWE-703)
High
2022-04-21
Denial of Service vulnerability in curl when parsing MQTT server response
curl Uncontrolled Resource Consumption (CWE-400)
Medium
2022-03-28
Use of Unsafe function || Strcpy
curl Classic Buffer Overflow (CWE-120)
High
2022-03-09
Binary output bypass
curl Classic Buffer Overflow (CWE-120)
Low
2022-03-09
Occasional use-after-free in multi_done() libcurl-7.81.0
curl Use After Free (CWE-416)
Low
2022-03-09
Remote memory disclosure vulnerability in libcurl on 64 Bit Windows
curl Information Exposure Through Sent Data (CWE-201)
High
2022-02-21
CVE-2021-22946: Protocol downgrade required TLS bypassed
curl Missing Required Cryptographic Step (CWE-325)CVE-2021-22946
Medium
2021-09-24
CVE-2021-22947: STARTTLS protocol injection via MITM
curl Cryptographic Issues - Generic (CWE-310)CVE-2021-22947
Medium
2021-09-24
Top Weakness Types
Most Active Programs
ProgramReportsMax $
U.S. Dept Of Defense896—
Internet Bug Bounty817—
HackerOne609—
Nextcloud582—
Shopify464—
curl439—
Node.js third-party modules307—
GitLab258—
X / xAI250 $2,500
Uber239 $9,895